aws / aws/chalice

The 'chalice gen-policy' output should include logs:* permissions

Open
#1,199 1 comment 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
11.1k
Forks
1k
Avg merge
1d 22h
Merged PRs (30d)
2

Description

Hi,

It might not be a bug but it caused me a lot of headaches.

I had to create a policy file manually using `chalice gen-policy` some weeks ago to overcome another issue ( #1198).

It wasn't apparent right after I've deployed the API with `chalice deploy --no-autogen-policy` that the API does not write any logs, regardless I was using `python/logging` package, the default `app.log.*` or `print()` statements. I wasted long hours trying to find a workaround until I found out that there must be something about the API (Lambda) permissions.

It is so trivial, the logging permission section is completely missing from the output of `chalice gen-policy`

Adding this to my manual policy solved my issue.
```json
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:*"
},
```

It would be nice if the `chalice gen-policy` would provide all required/default permissions, and thus we could select which we need to include in our manual policy.

Thanks

Contributor guide

Open the contributing guide

Research direction

Start at the `chalice gen-policy` command and inspect how its generated policy is assembled. Verify the output against the logging permissions described in the issue, including `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents`; done means the generated policy includes the required logging permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.